Adversarial Prompts for Acceptance Collapse in Speculative Decoding
ADSD introduces a prompt suffix attack exploiting Soft-Collapse to collapse verifier acceptance, reducing speculative decoding speed by over 60%.
Key Findings
Methodology
This paper proposes ADSD, an adversarial prompt suffix method targeting the internal verifier of speculative decoding. Using the Soft-Collapse objective, it guides the suffix to push draft token probabilities into the verifier’s rejection zone, significantly increasing decoding latency. The approach incorporates a target preservation KL divergence to maintain output semantic fidelity. Gradient-guided sequential beam search optimizes discrete suffixes across multiple prompts and rollout steps. Experiments on GSM8K, HumanEval, and CNN/DailyMail demonstrate broad effectiveness across models (e.g., LLaMA-3, EAGLE-3) and decoding strategies, revealing a systemic vulnerability in the core verification mechanism.
Key Results
- On GSM8K, ADSD increases average sample time from 26.05s to 42.29s (+62.3%), with minimal impact on task accuracy (0.802 vs. 0.821). The attack transfers well to different models and tasks, reducing block efficiency from 6.028 to 3.683 tokens per verification and decoding speed from 81.19 to 51.91 tokens/sec.
- Compared to baseline random suffixes and advanced gradient-guided search, ADSD achieves superior slowdown while preserving output quality. Cross-domain tests show significant latency increases in code generation (141.8%) and summarization (30.4%), indicating strong transferability.
- Ablation studies confirm that both Soft-Collapse and target KL divergence are essential: removing Soft-Collapse nullifies the attack, while removing KL causes semantic degradation. The method remains effective across different decoding strategies, indicating robustness and wide applicability.
Significance
This work uncovers a critical security flaw in the core verification process of speculative decoding, challenging its assumption of lossless acceleration. By manipulating the internal acceptance mechanism via prompt suffixes, attackers can cause substantial computational overhead and latency, threatening large-scale deployment reliability. The findings urge the community to rethink verification robustness and develop defenses against prompt-based adversarial manipulations, ensuring safer deployment of accelerated language models.
Technical Contribution
The paper introduces a novel adversarial framework targeting the asymmetric acceptance rule in speculative decoding, leveraging the Soft-Collapse surrogate to steer draft tokens into rejection regions. It combines gradient-guided discrete suffix search with a target preservation KL constraint, enabling highly effective, stealthy attacks. This approach advances understanding of internal model vulnerabilities and opens new directions for secure model design, emphasizing the importance of internal verification mechanisms in safeguarding inference speed and reliability.
Novelty
This is the first work to exploit prompt-induced internal verifier collapse within speculative decoding, diverging from prior safety or output-length attacks. The core innovation lies in aligning the attack with the asymmetric acceptance rule via Soft-Collapse, enabling subtle yet powerful slowdown attacks that do not compromise output semantics. Its broad applicability across models and strategies marks a significant step forward in adversarial research for large language models.
Limitations
- The attack assumes white-box access to model parameters and verification rules, limiting immediate applicability in black-box scenarios. Real-world defenses may mitigate some effects.
- Optimization of suffixes incurs computational costs, especially for large prompt sets or real-time deployment.
- Current method mainly targets specific acceptance rules; future work should explore more general or adaptive attack strategies against diverse verification mechanisms.
Future Work
Future research will focus on developing robust defenses, such as multi-layer verification, anomaly detection, and adaptive safeguards. Extending the attack to black-box settings and exploring defenses against more complex verification rules are also promising directions. Additionally, designing inherently secure speculative decoding architectures remains a critical challenge for ensuring both efficiency and safety in large-scale deployment.
AI Executive Summary
Speculative decoding has emerged as a promising technique to accelerate large language model inference without sacrificing output quality. By proposing candidate tokens with a draft model and verifying them with a target model, it achieves significant speedups. However, this paper reveals a critical vulnerability: an adversary can craft prompt suffixes that manipulate the internal verification process, causing the verifier to reject most draft tokens. This leads to repeated drafting and verification cycles, drastically reducing efficiency.
The authors introduce ADSD, a novel adversarial attack framework that leverages the Soft-Collapse surrogate objective to guide prompt suffixes into the verifier’s rejection zone. By optimizing these suffixes through gradient-guided sequential beam search, ADSD effectively inflates inference latency—by over 60%—while maintaining high output fidelity. Extensive experiments across multiple datasets, models, and decoding strategies demonstrate the attack’s broad applicability and robustness, exposing a systemic flaw in the core verification mechanism.
This discovery has profound implications for the deployment of large language models. It challenges the assumption that verification mechanisms are inherently secure and highlights the need for more resilient safeguards. The work underscores the importance of internal process robustness, not just output safety, in ensuring reliable, efficient AI systems.
Looking ahead, the authors advocate for developing advanced defenses, including multi-layer verification and anomaly detection, to counteract prompt-based adversarial attacks. Their findings serve as a wake-up call for the AI community to prioritize security alongside efficiency, ensuring that the promise of accelerated inference does not come at the expense of system integrity and availability.
Deep Dive
Abstract
Lossless acceleration schemes, such as speculative decoding, promise significant inference speedups by relying on dynamic token-level alignment between a draft and a target model. However, this guarantee of semantic equivalence masks a severe operational vulnerability: draft-target alignment can be systematically attacked. In this paper, we introduce ADSD, which, to the best of our knowledge, is the first prompt-suffix attack that collapses verifier acceptance by pushing draft probability mass toward tokens the target is unlikely to accept. ADSD uses Soft-Collapse, a verifier-aligned surrogate derived from the asymmetric speculative acceptance rule, together with a target-preservation objective that discourages obvious task corruption. ADSD successfully generates highly effective adversarial suffixes. On the GSM8K dataset, our attack increases the mean sample time by 62.3% while preserving the task quality. We further show that this vulnerability exists across different domains, speculative decoding strategies, and model architectures.